confirmed_at added to users, sessions controller complete according to spec